* [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put
@ 2026-10-22 0:29 syzbot
2026-10-22 12:11 ` Forwarded: media: em28xx: fix refcount underflow caused by em28xx_free_v4l2 syzbot
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: syzbot @ 2026-10-22 0:29 UTC (permalink / raw)
To: linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 8f7df005a756 Add linux-next specific files for 20261020
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1061bb05580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9c1b9b13e3e4ce1a
dashboard link: https://syzkaller.appspot.com/bug?extid=809dfc586f33fc44b6ac
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1104258e580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=176a5481580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4ecf38da9706/disk-8f7df005.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/feab027e2efe/vmlinux-8f7df005.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ded91a573e5a/bzImage-8f7df005.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+809dfc586f33fc44b6ac@syzkaller.appspotmail.com
refcount_t: underflow; use-after-free.
------------[ cut here ]------------
kernel BUG at lib/refcount.c:37!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 7562 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:refcount_warn_saturate+0x104/0x110 lib/refcount.c:37
Code: 5d ff ff ff e8 4d c1 d1 fc 48 c7 c7 00 e3 8d 8c e8 61 69 30 fc 90 0f 0b e8 39 c1 d1 fc 48 c7 c7 80 e3 8d 8c e8 4d 69 30 fc 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900065b7cc0 EFLAGS: 00010246
RAX: 0000000000000026 RBX: 0000000000000003 RCX: 86d7792bd9d84300
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff90033f40
RBP: 0000000000000000 R08: ffffffff81a6b7f0 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff237c1d8 R12: 1ffffffff1973318
R13: dffffc0000000000 R14: ffff88807cc000b0 R15: ffffffff882fcb70
FS: 00007f2b1fb76880(0000) GS:ffff8881234da000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055aef7b1964d CR3: 0000000075e40000 CR4: 00000000003526f0
Call Trace:
<TASK>
__refcount_sub_and_test include/linux/refcount.h:400 [inline]
__refcount_dec_and_test include/linux/refcount.h:432 [inline]
refcount_dec_and_test include/linux/refcount.h:450 [inline]
kref_put include/linux/kref.h:64 [inline]
v4l2_device_put+0xc2/0xd0 drivers/media/v4l2-core/v4l2-device.c:56
device_release+0xc4/0x1f0 drivers/base/core.c:-1
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x222/0x550 lib/kobject.c:737
video_put drivers/media/v4l2-core/v4l2-dev.c:173 [inline]
v4l2_release+0x273/0x350 drivers/media/v4l2-core/v4l2-dev.c:480
__fput+0x408/0xa40 fs/file_table.c:513
fput_close_sync+0x11f/0x240 fs/file_table.c:619
filp_close_sync fs/open.c:1897 [inline]
__do_sys_close fs/open.c:2153 [inline]
__se_sys_close+0xa2/0x160 fs/open.c:2140
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2b1f4a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fffdbbfc440 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007f2b1fb76880 RCX: 00007f2b1f4a7407
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f2b1fb766e8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000013
R13: 00007fffdbbfc670 R14: 00007f2b1fcdd000 R15: 000055aef7b1d4d8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:refcount_warn_saturate+0x104/0x110 lib/refcount.c:37
Code: 5d ff ff ff e8 4d c1 d1 fc 48 c7 c7 00 e3 8d 8c e8 61 69 30 fc 90 0f 0b e8 39 c1 d1 fc 48 c7 c7 80 e3 8d 8c e8 4d 69 30 fc 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900065b7cc0 EFLAGS: 00010246
RAX: 0000000000000026 RBX: 0000000000000003 RCX: 86d7792bd9d84300
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff90033f40
RBP: 0000000000000000 R08: ffffffff81a6b7f0 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff237c1d8 R12: 1ffffffff1973318
R13: dffffc0000000000 R14: ffff88807cc000b0 R15: ffffffff882fcb70
FS: 00007f2b1fb76880(0000) GS:ffff8881234da000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055aef7b1964d CR3: 0000000075e40000 CR4: 00000000003526f0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 5+ messages in thread
* Forwarded: media: em28xx: fix refcount underflow caused by em28xx_free_v4l2
2026-10-22 0:29 [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put syzbot
@ 2026-10-22 12:11 ` syzbot
2026-10-22 14:53 ` Forwarded: Re: [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put syzbot
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-10-22 12:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: media: em28xx: fix refcount underflow caused by em28xx_free_v4l2
Author: neganhat@gmail.com
#syz test: linux-next 8f7df005a756
^ permalink raw reply [flat|nested] 5+ messages in thread
* Forwarded: Re: [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put
2026-10-22 0:29 [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put syzbot
2026-10-22 12:11 ` Forwarded: media: em28xx: fix refcount underflow caused by em28xx_free_v4l2 syzbot
@ 2026-10-22 14:53 ` syzbot
2026-10-22 16:17 ` syzbot
2026-11-01 20:39 ` Forwarded: [PATCH] media: em28xx: fix v4l2 use-after-free after failed init syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-10-22 14:53 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put
Author: neganhat@gmail.com
#syz test: linux-next 8f7df005a756
On Thu, Oct 22, 2026 at 9:08 PM syzbot
<syzbot+809dfc586f33fc44b6ac@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KASAN: slab-use-after-free Read in v4l2_release
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in v4l2_device_supports_requests include/media/v4l2-device.h:252 [inline]
> BUG: KASAN: slab-use-after-free in v4l2_release+0xfe/0x350 drivers/media/v4l2-core/v4l2-dev.c:466
> Read of size 8 at addr ffff888035785b10 by task v4l_id/7282
>
> CPU: 1 UID: 0 PID: 7282 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
> Call Trace:
> <TASK>
> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
> print_address_description+0x55/0x1e0 mm/kasan/report.c:378
> print_report+0x58/0x70 mm/kasan/report.c:482
> kasan_report+0x117/0x150 mm/kasan/report.c:595
> v4l2_device_supports_requests include/media/v4l2-device.h:252 [inline]
> v4l2_release+0xfe/0x350 drivers/media/v4l2-core/v4l2-dev.c:466
> __fput+0x408/0xa40 fs/file_table.c:513
> fput_close_sync+0x11f/0x240 fs/file_table.c:619
> filp_close_sync fs/open.c:1897 [inline]
> __do_sys_close fs/open.c:2153 [inline]
> __se_sys_close+0xa2/0x160 fs/open.c:2140
> do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
> do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f4a56ca7407
> Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
> RSP: 002b:00007ffcfee18b00 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
> RAX: ffffffffffffffda RBX: 00007f4a57357880 RCX: 00007f4a56ca7407
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
> RBP: 00007f4a573576e8 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000013
> R13: 00007ffcfee18d30 R14: 00007f4a5745c000 R15: 0000557c8543f4d8
> </TASK>
>
> Allocated by task 5749:
> kasan_save_stack mm/kasan/common.c:57 [inline]
> kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
> __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
> kasan_kmalloc include/linux/kasan.h:263 [inline]
> __kmalloc_cache_noprof+0x31c/0x600 mm/slub.c:5680
> _kmalloc_noprof include/linux/slab.h:991 [inline]
> _kzalloc_noprof include/linux/slab.h:1312 [inline]
> em28xx_media_device_init drivers/media/usb/em28xx/em28xx-cards.c:3757 [inline]
> em28xx_init_dev+0x857/0x2680 drivers/media/usb/em28xx/em28xx-cards.c:3947
> em28xx_usb_probe+0x17b2/0x2dd0 drivers/media/usb/em28xx/em28xx-cards.c:4324
> usb_probe_interface+0x751/0xe00 drivers/usb/core/driver.c:399
> call_driver_probe drivers/base/dd.c:-1 [inline]
> really_probe+0x254/0xae0 drivers/base/dd.c:707
> __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:869
> driver_probe_device+0x4f/0x240 drivers/base/dd.c:899
> __device_attach_driver+0x270/0x410 drivers/base/dd.c:1027
> bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
> __device_attach+0x2bd/0x430 drivers/base/dd.c:1131
> device_initial_probe+0x9c/0x100 drivers/base/dd.c:1190
> __bus_probe_device+0x126/0x220 drivers/base/bus.c:617
> device_add+0x7d7/0xb80 drivers/base/core.c:3776
> usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2280
> usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
> usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
> call_driver_probe drivers/base/dd.c:-1 [inline]
> really_probe+0x254/0xae0 drivers/base/dd.c:707
> __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:869
> driver_probe_device+0x4f/0x240 drivers/base/dd.c:899
> __device_attach_driver+0x270/0x410 drivers/base/dd.c:1027
> bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
> __device_attach+0x2bd/0x430 drivers/base/dd.c:1131
> device_initial_probe+0x9c/0x100 drivers/base/dd.c:1190
> __bus_probe_device+0x126/0x220 drivers/base/bus.c:617
> device_add+0x7d7/0xb80 drivers/base/core.c:3776
> usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713
> hub_port_connect drivers/usb/core/hub.c:5585 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
> port_event drivers/usb/core/hub.c:5889 [inline]
> hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971
> process_one_work kernel/workqueue.c:3495 [inline]
> process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
> worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
> kthread+0x38b/0x480 kernel/kthread.c:436
> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>
> Freed by task 5749:
> kasan_save_stack mm/kasan/common.c:57 [inline]
> kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
> poison_slab_object mm/kasan/common.c:264 [inline]
> __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
> kasan_slab_free include/linux/kasan.h:235 [inline]
> slab_free_hook mm/slub.c:2780 [inline]
> slab_free mm/slub.c:6630 [inline]
> kfree+0x1c5/0x650 mm/slub.c:6923
> em28xx_unregister_media_device drivers/media/usb/em28xx/em28xx-cards.c:3779 [inline]
> em28xx_release_resources+0xde/0x240 drivers/media/usb/em28xx/em28xx-cards.c:3798
> em28xx_usb_disconnect+0x19f/0x2f0 drivers/media/usb/em28xx/em28xx-cards.c:4493
> usb_unbind_interface+0x295/0x9c0 drivers/usb/core/driver.c:460
> device_remove drivers/base/dd.c:619 [inline]
> __device_release_driver drivers/base/dd.c:1357 [inline]
> device_release_driver_internal+0x48d/0x7d0 drivers/base/dd.c:1380
> bus_remove_device+0x444/0x560 drivers/base/bus.c:681
> device_del+0x524/0x8f0 drivers/base/core.c:3965
> usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1484
> usb_disconnect+0x346/0x9a0 drivers/usb/core/hub.c:2355
> hub_port_connect drivers/usb/core/hub.c:5425 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
> port_event drivers/usb/core/hub.c:5889 [inline]
> hub_event+0x1bbb/0x4d30 drivers/usb/core/hub.c:5971
> process_one_work kernel/workqueue.c:3495 [inline]
> process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
> worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
> kthread+0x38b/0x480 kernel/kthread.c:436
> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>
> The buggy address belongs to the object at ffff888035785800
> which belongs to the cache kmalloc-1k of size 1024
> The buggy address is located 784 bytes inside of
> freed 1024-byte region [ffff888035785800, ffff888035785c00)
>
> The buggy address belongs to the physical page:
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35780
> head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
> page_type: f5(slab)
> raw: 00fff00000000040 ffff88813ff2bdc0 dead000000000100 dead000000000122
> raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
> head: 00fff00000000040 ffff88813ff2bdc0 dead000000000100 dead000000000122
> head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
> head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
> head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 162, tgid 162 (kworker/u8:7), ts 176383093465
> set_page_owner include/linux/page_owner.h:33 [inline]
> post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
> prep_new_page mm/page_alloc.c:1864 [inline]
> get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
> __alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5459
> alloc_slab_page mm/slub.c:3384 [inline]
> allocate_slab+0x7d/0x5e0 mm/slub.c:3499
> new_slab mm/slub.c:3550 [inline]
> refill_objects+0x2d5/0x350 mm/slub.c:7539
> refill_sheaf mm/slub.c:2917 [inline]
> __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4811
> alloc_from_pcs mm/slub.c:4887 [inline]
> slab_alloc_node mm/slub.c:5021 [inline]
> __do_kmalloc_node mm/slub.c:5530 [inline]
> __kmalloc_noprof+0x476/0x710 mm/slub.c:5556
> _kmalloc_noprof include/linux/slab.h:995 [inline]
> _kzalloc_noprof include/linux/slab.h:1312 [inline]
> ieee802_11_parse_elems_full+0x14b/0x2a10 net/mac80211/parse.c:1077
> ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2583 [inline]
> ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1542 [inline]
> ieee80211_ibss_rx_queued_mgmt+0x509/0x2c40 net/mac80211/ibss.c:1573
> ieee80211_iface_process_skb net/mac80211/iface.c:1805 [inline]
> ieee80211_iface_work+0x769/0xfa0 net/mac80211/iface.c:1859
> cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:610
> process_one_work kernel/workqueue.c:3495 [inline]
> process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
> worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
> kthread+0x38b/0x480 kernel/kthread.c:436
> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> page last free pid 31 tgid 31 ts 176051931514 stack trace:
> reset_page_owner include/linux/page_owner.h:26 [inline]
> __free_pages_prepare mm/page_alloc.c:1403 [inline]
> __free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
> __slab_free+0x269/0x2c0 mm/slub.c:5926
> qlink_free mm/kasan/quarantine.c:163 [inline]
> qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
> kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
> __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:361
> kasan_slab_alloc include/linux/kasan.h:253 [inline]
> slab_post_alloc_hook mm/slub.c:4720 [inline]
> slab_alloc_node mm/slub.c:5033 [inline]
> __kmalloc_cache_noprof+0x29a/0x600 mm/slub.c:5676
> _kmalloc_noprof include/linux/slab.h:991 [inline]
> dummy_urb_enqueue+0x7c/0x7a0 drivers/usb/gadget/udc/dummy_hcd.c:1327
> usb_hcd_submit_urb+0x328/0x1b60 drivers/usb/core/hcd.c:1543
> usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
> usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
> usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
> get_bMaxPacketSize0 drivers/usb/core/hub.c:4869 [inline]
> hub_port_init+0xb0b/0x28c0 drivers/usb/core/hub.c:5065
> hub_port_connect drivers/usb/core/hub.c:5514 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
> port_event drivers/usb/core/hub.c:5889 [inline]
> hub_event+0x24e8/0x4d30 drivers/usb/core/hub.c:5971
> process_one_work kernel/workqueue.c:3495 [inline]
> process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
> worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
> kthread+0x38b/0x480 kernel/kthread.c:436
> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>
> Memory state around the buggy address:
> ffff888035785a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888035785a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> >ffff888035785b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff888035785b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888035785c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ==================================================================
>
>
> Tested on:
>
> commit: 8f7df005 Add linux-next specific files for 20261020
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=120a9fa9580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=9c1b9b13e3e4ce1a
> dashboard link: https://syzkaller.appspot.com/bug?extid=809dfc586f33fc44b6ac
> compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> patch: https://syzkaller.appspot.com/x/patch.diff?x=17b7b50d580000
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Forwarded: Re: [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put
2026-10-22 0:29 [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put syzbot
2026-10-22 12:11 ` Forwarded: media: em28xx: fix refcount underflow caused by em28xx_free_v4l2 syzbot
2026-10-22 14:53 ` Forwarded: Re: [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put syzbot
@ 2026-10-22 16:17 ` syzbot
2026-11-01 20:39 ` Forwarded: [PATCH] media: em28xx: fix v4l2 use-after-free after failed init syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-10-22 16:17 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put
Author: neganhat@gmail.com
#syz test: linux-next 8f7df005a756
On Thu, Oct 22, 2026 at 9:52 PM Nhật Anh Nguyễn Duy <neganhat@gmail.com> wrote:
>
> #syz test: linux-next 8f7df005a756
>
> On Thu, Oct 22, 2026 at 9:08 PM syzbot
> <syzbot+809dfc586f33fc44b6ac@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> > KASAN: slab-use-after-free Read in v4l2_release
> >
> > ==================================================================
> > BUG: KASAN: slab-use-after-free in v4l2_device_supports_requests include/media/v4l2-device.h:252 [inline]
> > BUG: KASAN: slab-use-after-free in v4l2_release+0xfe/0x350 drivers/media/v4l2-core/v4l2-dev.c:466
> > Read of size 8 at addr ffff888035785b10 by task v4l_id/7282
> >
> > CPU: 1 UID: 0 PID: 7282 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full)
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
> > Call Trace:
> > <TASK>
> > dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
> > print_address_description+0x55/0x1e0 mm/kasan/report.c:378
> > print_report+0x58/0x70 mm/kasan/report.c:482
> > kasan_report+0x117/0x150 mm/kasan/report.c:595
> > v4l2_device_supports_requests include/media/v4l2-device.h:252 [inline]
> > v4l2_release+0xfe/0x350 drivers/media/v4l2-core/v4l2-dev.c:466
> > __fput+0x408/0xa40 fs/file_table.c:513
> > fput_close_sync+0x11f/0x240 fs/file_table.c:619
> > filp_close_sync fs/open.c:1897 [inline]
> > __do_sys_close fs/open.c:2153 [inline]
> > __se_sys_close+0xa2/0x160 fs/open.c:2140
> > do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
> > do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > RIP: 0033:0x7f4a56ca7407
> > Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
> > RSP: 002b:00007ffcfee18b00 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
> > RAX: ffffffffffffffda RBX: 00007f4a57357880 RCX: 00007f4a56ca7407
> > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
> > RBP: 00007f4a573576e8 R08: 0000000000000000 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000013
> > R13: 00007ffcfee18d30 R14: 00007f4a5745c000 R15: 0000557c8543f4d8
> > </TASK>
> >
> > Allocated by task 5749:
> > kasan_save_stack mm/kasan/common.c:57 [inline]
> > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
> > __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
> > kasan_kmalloc include/linux/kasan.h:263 [inline]
> > __kmalloc_cache_noprof+0x31c/0x600 mm/slub.c:5680
> > _kmalloc_noprof include/linux/slab.h:991 [inline]
> > _kzalloc_noprof include/linux/slab.h:1312 [inline]
> > em28xx_media_device_init drivers/media/usb/em28xx/em28xx-cards.c:3757 [inline]
> > em28xx_init_dev+0x857/0x2680 drivers/media/usb/em28xx/em28xx-cards.c:3947
> > em28xx_usb_probe+0x17b2/0x2dd0 drivers/media/usb/em28xx/em28xx-cards.c:4324
> > usb_probe_interface+0x751/0xe00 drivers/usb/core/driver.c:399
> > call_driver_probe drivers/base/dd.c:-1 [inline]
> > really_probe+0x254/0xae0 drivers/base/dd.c:707
> > __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:869
> > driver_probe_device+0x4f/0x240 drivers/base/dd.c:899
> > __device_attach_driver+0x270/0x410 drivers/base/dd.c:1027
> > bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
> > __device_attach+0x2bd/0x430 drivers/base/dd.c:1131
> > device_initial_probe+0x9c/0x100 drivers/base/dd.c:1190
> > __bus_probe_device+0x126/0x220 drivers/base/bus.c:617
> > device_add+0x7d7/0xb80 drivers/base/core.c:3776
> > usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2280
> > usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
> > usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
> > call_driver_probe drivers/base/dd.c:-1 [inline]
> > really_probe+0x254/0xae0 drivers/base/dd.c:707
> > __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:869
> > driver_probe_device+0x4f/0x240 drivers/base/dd.c:899
> > __device_attach_driver+0x270/0x410 drivers/base/dd.c:1027
> > bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:503
> > __device_attach+0x2bd/0x430 drivers/base/dd.c:1131
> > device_initial_probe+0x9c/0x100 drivers/base/dd.c:1190
> > __bus_probe_device+0x126/0x220 drivers/base/bus.c:617
> > device_add+0x7d7/0xb80 drivers/base/core.c:3776
> > usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713
> > hub_port_connect drivers/usb/core/hub.c:5585 [inline]
> > hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
> > port_event drivers/usb/core/hub.c:5889 [inline]
> > hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971
> > process_one_work kernel/workqueue.c:3495 [inline]
> > process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
> > worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
> > kthread+0x38b/0x480 kernel/kthread.c:436
> > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> >
> > Freed by task 5749:
> > kasan_save_stack mm/kasan/common.c:57 [inline]
> > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
> > poison_slab_object mm/kasan/common.c:264 [inline]
> > __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
> > kasan_slab_free include/linux/kasan.h:235 [inline]
> > slab_free_hook mm/slub.c:2780 [inline]
> > slab_free mm/slub.c:6630 [inline]
> > kfree+0x1c5/0x650 mm/slub.c:6923
> > em28xx_unregister_media_device drivers/media/usb/em28xx/em28xx-cards.c:3779 [inline]
> > em28xx_release_resources+0xde/0x240 drivers/media/usb/em28xx/em28xx-cards.c:3798
> > em28xx_usb_disconnect+0x19f/0x2f0 drivers/media/usb/em28xx/em28xx-cards.c:4493
> > usb_unbind_interface+0x295/0x9c0 drivers/usb/core/driver.c:460
> > device_remove drivers/base/dd.c:619 [inline]
> > __device_release_driver drivers/base/dd.c:1357 [inline]
> > device_release_driver_internal+0x48d/0x7d0 drivers/base/dd.c:1380
> > bus_remove_device+0x444/0x560 drivers/base/bus.c:681
> > device_del+0x524/0x8f0 drivers/base/core.c:3965
> > usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1484
> > usb_disconnect+0x346/0x9a0 drivers/usb/core/hub.c:2355
> > hub_port_connect drivers/usb/core/hub.c:5425 [inline]
> > hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
> > port_event drivers/usb/core/hub.c:5889 [inline]
> > hub_event+0x1bbb/0x4d30 drivers/usb/core/hub.c:5971
> > process_one_work kernel/workqueue.c:3495 [inline]
> > process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
> > worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
> > kthread+0x38b/0x480 kernel/kthread.c:436
> > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> >
> > The buggy address belongs to the object at ffff888035785800
> > which belongs to the cache kmalloc-1k of size 1024
> > The buggy address is located 784 bytes inside of
> > freed 1024-byte region [ffff888035785800, ffff888035785c00)
> >
> > The buggy address belongs to the physical page:
> > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35780
> > head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> > flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
> > page_type: f5(slab)
> > raw: 00fff00000000040 ffff88813ff2bdc0 dead000000000100 dead000000000122
> > raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
> > head: 00fff00000000040 ffff88813ff2bdc0 dead000000000100 dead000000000122
> > head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
> > head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
> > head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> > page dumped because: kasan: bad access detected
> > page_owner tracks the page as allocated
> > page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 162, tgid 162 (kworker/u8:7), ts 176383093465
> > set_page_owner include/linux/page_owner.h:33 [inline]
> > post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1856
> > prep_new_page mm/page_alloc.c:1864 [inline]
> > get_page_from_freelist+0x220f/0x2280 mm/page_alloc.c:3935
> > __alloc_frozen_pages_noprof+0x1fe/0x410 mm/page_alloc.c:5459
> > alloc_slab_page mm/slub.c:3384 [inline]
> > allocate_slab+0x7d/0x5e0 mm/slub.c:3499
> > new_slab mm/slub.c:3550 [inline]
> > refill_objects+0x2d5/0x350 mm/slub.c:7539
> > refill_sheaf mm/slub.c:2917 [inline]
> > __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4811
> > alloc_from_pcs mm/slub.c:4887 [inline]
> > slab_alloc_node mm/slub.c:5021 [inline]
> > __do_kmalloc_node mm/slub.c:5530 [inline]
> > __kmalloc_noprof+0x476/0x710 mm/slub.c:5556
> > _kmalloc_noprof include/linux/slab.h:995 [inline]
> > _kzalloc_noprof include/linux/slab.h:1312 [inline]
> > ieee802_11_parse_elems_full+0x14b/0x2a10 net/mac80211/parse.c:1077
> > ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2583 [inline]
> > ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1542 [inline]
> > ieee80211_ibss_rx_queued_mgmt+0x509/0x2c40 net/mac80211/ibss.c:1573
> > ieee80211_iface_process_skb net/mac80211/iface.c:1805 [inline]
> > ieee80211_iface_work+0x769/0xfa0 net/mac80211/iface.c:1859
> > cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:610
> > process_one_work kernel/workqueue.c:3495 [inline]
> > process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
> > worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
> > kthread+0x38b/0x480 kernel/kthread.c:436
> > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> > page last free pid 31 tgid 31 ts 176051931514 stack trace:
> > reset_page_owner include/linux/page_owner.h:26 [inline]
> > __free_pages_prepare mm/page_alloc.c:1403 [inline]
> > __free_frozen_pages+0xc97/0xd90 mm/page_alloc.c:2954
> > __slab_free+0x269/0x2c0 mm/slub.c:5926
> > qlink_free mm/kasan/quarantine.c:163 [inline]
> > qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
> > kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
> > __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:361
> > kasan_slab_alloc include/linux/kasan.h:253 [inline]
> > slab_post_alloc_hook mm/slub.c:4720 [inline]
> > slab_alloc_node mm/slub.c:5033 [inline]
> > __kmalloc_cache_noprof+0x29a/0x600 mm/slub.c:5676
> > _kmalloc_noprof include/linux/slab.h:991 [inline]
> > dummy_urb_enqueue+0x7c/0x7a0 drivers/usb/gadget/udc/dummy_hcd.c:1327
> > usb_hcd_submit_urb+0x328/0x1b60 drivers/usb/core/hcd.c:1543
> > usb_start_wait_urb+0x13f/0x5b0 drivers/usb/core/message.c:62
> > usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
> > usb_control_msg+0x234/0x3e0 drivers/usb/core/message.c:167
> > get_bMaxPacketSize0 drivers/usb/core/hub.c:4869 [inline]
> > hub_port_init+0xb0b/0x28c0 drivers/usb/core/hub.c:5065
> > hub_port_connect drivers/usb/core/hub.c:5514 [inline]
> > hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
> > port_event drivers/usb/core/hub.c:5889 [inline]
> > hub_event+0x24e8/0x4d30 drivers/usb/core/hub.c:5971
> > process_one_work kernel/workqueue.c:3495 [inline]
> > process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
> > worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
> > kthread+0x38b/0x480 kernel/kthread.c:436
> > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> >
> > Memory state around the buggy address:
> > ffff888035785a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ffff888035785a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > >ffff888035785b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ^
> > ffff888035785b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ffff888035785c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > ==================================================================
> >
> >
> > Tested on:
> >
> > commit: 8f7df005 Add linux-next specific files for 20261020
> > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
> > console output: https://syzkaller.appspot.com/x/log.txt?x=120a9fa9580000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=9c1b9b13e3e4ce1a
> > dashboard link: https://syzkaller.appspot.com/bug?extid=809dfc586f33fc44b6ac
> > compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> > patch: https://syzkaller.appspot.com/x/patch.diff?x=17b7b50d580000
> >
^ permalink raw reply [flat|nested] 5+ messages in thread
* Forwarded: [PATCH] media: em28xx: fix v4l2 use-after-free after failed init
2026-10-22 0:29 [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put syzbot
` (2 preceding siblings ...)
2026-10-22 16:17 ` syzbot
@ 2026-11-01 20:39 ` syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-11-01 20:39 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] media: em28xx: fix v4l2 use-after-free after failed init
Author: drifabdelmalekmohamedsaid@gmail.com
#syz test
---
drivers/media/usb/em28xx/em28xx-video.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index 84424284d486..924a3f7977c9 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2414,7 +2414,7 @@ static int em28xx_v4l2_open(struct file *filp)
*/
static int em28xx_v4l2_fini(struct em28xx *dev)
{
- struct em28xx_v4l2 *v4l2 = dev->v4l2;
+ struct em28xx_v4l2 *v4l2;
if (dev->is_audio_only) {
/* Shouldn't initialize IR for this interface */
@@ -2426,13 +2426,17 @@ static int em28xx_v4l2_fini(struct em28xx *dev)
return 0;
}
- if (!v4l2)
- return 0;
-
dev_info(&dev->intf->dev, "Closing video extension\n");
mutex_lock(&dev->lock);
+ /* matches em28xx_v4l2_init error paths */
+ v4l2 = dev->v4l2;
+ if (!v4l2){
+ mutex_unlock(&dev->lock);
+ return 0;
+ }
+
v4l2_device_disconnect(&v4l2->v4l2_dev);
em28xx_uninit_usb_xfer(dev, EM28XX_ANALOG_MODE);
@@ -3129,6 +3133,9 @@ static int em28xx_v4l2_init(struct em28xx *dev)
vb2_video_unregister_device(&v4l2->vdev);
}
+ /* matches check in em28xx_v4l2_fini (under the same lock) */
+ dev->v4l2 = NULL;
+
mutex_unlock(&dev->lock);
/*
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-11-01 20:39 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-22 0:29 [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put syzbot
2026-10-22 12:11 ` Forwarded: media: em28xx: fix refcount underflow caused by em28xx_free_v4l2 syzbot
2026-10-22 14:53 ` Forwarded: Re: [syzbot] [media?] [usb?] kernel BUG in v4l2_device_put syzbot
2026-10-22 16:17 ` syzbot
2026-11-01 20:39 ` Forwarded: [PATCH] media: em28xx: fix v4l2 use-after-free after failed init syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.